Bug 152897
| Summary: | CAN-2005-0089 python SimpleXMLRPCServer security issue | ||
|---|---|---|---|
| Product: | [Retired] Fedora Legacy | Reporter: | Marc Deslauriers <marc.deslauriers> |
| Component: | python | Assignee: | Fedora Legacy Bugs <bugs> |
| Status: | CLOSED DUPLICATE | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | deisenst, michal |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0089 | ||
| Whiteboard: | 1, LEGACY, NEEDSWORK, rh73, rh90 | ||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2005-09-28 06:51:44 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 169235 | ||
| Bug Blocks: | |||
|
Description
David Lawrence
2005-03-30 23:31:21 UTC
Corresponding fixed Python packages were annouced in http://rhn.redhat.com/errata/RHSA-2005-109.html which has classification "Important". There is a package for RH7.3 at ftp://ftp.harddata.com/pub/Legacy_packages/python2-2.2.2-11.7.3.1.legacy.src.rpm These sources include a fix for CAN-2005-0089, and also for other SSL security issues (lifted from updates to RHEL) and a fix for pcre issues (CAN-2005-2491, #169235). Neither python-1.5.2-... packages, nor python-xmlrpc-1.5.1-7.x.3, for RH7.3 seem to be affected by CAN-2005-0089. It does not look that the code in question, or something similar, is there. For other distributions it seems that a fix for CAN-2005-0089 will be either the same or very similar as applied here. In any case a code from corresponding RHEL update sources will apply. (Michal and Jim - hope you don't mind my adding you to the cc: for this bug.) Since Michal has proposed the python2-2.2.2-11.7.3.1.legacy.src.rpm packages as a fix not only for the this bug report's issue, but also for the CAN-2005-2491 pcre issue (handled in Bug #169235), I suggest we re-title 169235 to be "CAN-2005-0089 CAN-2005-2491 python multiple security issues" and continue all work on CAN-2005-0089 there. We can make this bug report's success depend on that one. That way we can track all of python's pending security issues in one bug report rather than two. Would you mind changing the title of 169235, Jim? David, Thank you for adding me to this bug. For the record I would rather be added than deleted. ;-) I have renamed 169235 as you proposed. |